Bump GGCR

- Updates to go 1.17 for estargz dependency
- Updates golangci.yaml to work around golangci/golangci-lint#2875
- Updates linters to remove archived ones and add their replacements
- Fixes lint errors from updated linter

Signed-off-by: Natalie Arellano <narellano@vmware.com>

.github/workflows/test.yaml

@@ -16,7 +16,7 @@ jobs:
       - name: Set up go
         uses: actions/setup-go@v2
         with:
-          go-version: '1.15'
+          go-version: '1.17'
       - name: Test
         run: make test
   test-and-build-windows:
@@ -26,6 +26,6 @@ jobs:
       - name: Set up go
         uses: actions/setup-go@v2
         with:
-          go-version: '1.15'
+          go-version: '1.17'
       - name: Test
         run: make test

Makefile

@@ -40,3 +40,6 @@ endif
 
 test: layer/bcdhive_generated.go format lint
 	$(GOCMD) test -parallel=1 -count=1 -v ./...
+
+tidy:
+	$(GOCMD) mod tidy && cd tools && $(GOCMD) mod tidy -compat=1.17 && cd bcdhive_generator && $(GOCMD) mod tidy

go.mod

@@ -3,11 +3,35 @@ module github.com/buildpacks/imgutil
 require (
 	github.com/docker/docker v20.10.16+incompatible
 	github.com/google/go-cmp v0.5.8
-	github.com/google/go-containerregistry v0.8.0
-	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
-	github.com/opencontainers/image-spec v1.0.2 // indirect
+	github.com/google/go-containerregistry v0.9.0
 	github.com/pkg/errors v0.9.1
 	github.com/sclevine/spec v1.4.0
 )
 
-go 1.14
+require (
+	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	github.com/Microsoft/go-winio v0.5.2 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.11.4 // indirect
+	github.com/docker/cli v20.10.16+incompatible // indirect
+	github.com/docker/distribution v2.8.1+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.6.4 // indirect
+	github.com/docker/go-connections v0.4.0 // indirect
+	github.com/docker/go-units v0.4.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/klauspost/compress v1.15.5 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
+	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.0.3-0.20220114050600-8b9d41f48198 // indirect
+	github.com/sirupsen/logrus v1.8.1 // indirect
+	github.com/stretchr/testify v1.7.1 // indirect
+	github.com/vbatts/tar-split v0.11.2 // indirect
+	golang.org/x/net v0.0.0-20220526153639-5463443f8c37 // indirect
+	golang.org/x/sync v0.0.0-20220513210516-0976fa681c29 // indirect
+	golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a // indirect
+	golang.org/x/tools v0.1.11-0.20220518213611-904e24e9fcf9 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
+
+go 1.17

golangci.yaml

@@ -7,17 +7,16 @@ linters:
     - bodyclose
     - deadcode
     - dogsled
+    - exportloopref
     - gocritic
     - goimports
-    - golint
     - gosec
     - gosimple
     - govet
     - ineffassign
-    - maligned
     - misspell
     - nakedret
-    - scopelint
+    - revive
     - staticcheck
     - structcheck
     - stylecheck
@@ -29,4 +28,18 @@ linters:
 
 linters-settings:
   goimports:
-    local-prefixes: github.com/buildpacks/imgutil
+    local-prefixes: github.com/buildpacks/imgutil
+  govet:
+    enable:
+      - fieldalignment
+
+issues:
+  exclude-rules:
+    - linters:
+        - staticcheck
+      text: "SA1019: tarball.LayerFromReader is deprecated"
+    - linters:
+        # Ignore this minor optimization.
+        # See https://github.com/golang/go/issues/44877#issuecomment-794565908
+        - govet
+      text: "pointer bytes could be"

layer/windows_baselayer.go

@@ -7,7 +7,7 @@ import (
 )
 
 // Generate using `make generate`
-//go:generate docker run --rm -v $PWD:/out/ bcdhive-generator -file=/out/layer/bcdhive_generated.go -package=layer -func=BaseLayerBCD
+//go:generate docker run --rm -v $PWD:/out/ bcdhive-generator -file=/out/bcdhive_generated.go -package=layer -func=BaseLayerBCD
 
 // Windows base layers must follow this pattern:
 //  \-> UtilityVM/Files/EFI/Microsoft/Boot/BCD   (file must exist and a valid BCD format - from bcdhive_gen)

local/local.go

@@ -47,44 +47,44 @@ type options struct {
 	createdAt         time.Time
 }
 
-//WithPreviousImage loads an existing image as a source for reusable layers.
-//Use with ReuseLayer().
-//Ignored if image is not found.
+// WithPreviousImage loads an existing image as a source for reusable layers.
+// Use with ReuseLayer().
+// Ignored if image is not found.
 func WithPreviousImage(imageName string) ImageOption {
 	return func(i *options) error {
 		i.prevImageRepoName = imageName
 		return nil
 	}
 }
 
-//FromBaseImage loads an existing image as the config and layers for the new image.
-//Ignored if image is not found.
+// FromBaseImage loads an existing image as the config and layers for the new image.
+// Ignored if image is not found.
 func FromBaseImage(imageName string) ImageOption {
 	return func(i *options) error {
 		i.baseImageRepoName = imageName
 		return nil
 	}
 }
 
-//WithDefaultPlatform provides Architecture/OS/OSVersion defaults for the new image.
-//Defaults for a new image are ignored when FromBaseImage returns an image.
+// WithDefaultPlatform provides Architecture/OS/OSVersion defaults for the new image.
+// Defaults for a new image are ignored when FromBaseImage returns an image.
 func WithDefaultPlatform(platform imgutil.Platform) ImageOption {
 	return func(i *options) error {
 		i.platform = platform
 		return nil
 	}
 }
 
-//WithCreatedAt lets a caller set the created at timestamp for the image.
-//Defaults for a new image is imgutil.NormalizedDateTime
+// WithCreatedAt lets a caller set the created at timestamp for the image.
+// Defaults for a new image is imgutil.NormalizedDateTime
 func WithCreatedAt(createdAt time.Time) ImageOption {
 	return func(opts *options) error {
 		opts.createdAt = createdAt
 		return nil
 	}
 }
 
-//NewImage returns a new Image that can be modified and saved to a registry.
+// NewImage returns a new Image that can be modified and saved to a registry.
 func NewImage(repoName string, dockerClient client.CommonAPIClient, ops ...ImageOption) (*Image, error) {
 	imageOpts := &options{}
 	for _, op := range ops {
@@ -731,7 +731,10 @@ func untar(r io.Reader, dest string) error {
 			return err
 		}
 
-		path := filepath.Join(dest, hdr.Name)
+		path, err := cleanPath(dest, hdr.Name)
+		if err != nil {
+			return err
+		}
 
 		switch hdr.Typeflag {
 		case tar.TypeDir:
@@ -753,7 +756,7 @@ func untar(r io.Reader, dest string) error {
 			if _, err := io.Copy(fh, tr); err != nil {
 				fh.Close()
 				return err
-			}
+			} // #nosec G110
 			fh.Close()
 		case tar.TypeSymlink:
 			_, err := os.Stat(filepath.Dir(path))
@@ -772,6 +775,14 @@ func untar(r io.Reader, dest string) error {
 	}
 }
 
+func cleanPath(dest, header string) (string, error) {
+	joined := filepath.Join(dest, header)
+	if strings.HasPrefix(joined, filepath.Clean(dest)) {
+		return joined, nil
+	}
+	return "", fmt.Errorf("bad filepath: %s", header)
+}
+
 func inspectOptionalImage(docker client.CommonAPIClient, imageName string, platform imgutil.Platform) (types.ImageInspect, error) {
 	var (
 		err     error

local/local_test.go

@@ -119,13 +119,13 @@ func testImage(t *testing.T, when spec.G, it spec.S) {
 				daemonInfo, err := dockerClient.Info(context.TODO())
 				h.AssertNil(t, err)
 
-				//image os must match daemon
+				// image os must match daemon
 				h.AssertEq(t, inspect.Os, daemonInfo.OSType)
 				h.AssertEq(t, inspect.Architecture, expectedArmArch)
 				h.AssertEq(t, inspect.OsVersion, expectedOSVersion)
 				h.AssertEq(t, inspect.RootFS.Type, "layers")
 
-				//base layer is added for windows
+				// base layer is added for windows
 				if daemonOS == "windows" {
 					h.AssertEq(t, len(inspect.RootFS.Layers), 1)
 				} else {
@@ -175,7 +175,7 @@ func testImage(t *testing.T, when spec.G, it spec.S) {
 
 						h.AssertNil(t, err)
 
-						//base layer is added for windows
+						// base layer is added for windows
 						if daemonOS == "windows" {
 							topLayerDiffID, err := img.TopLayer()
 							h.AssertNil(t, err)
@@ -312,12 +312,12 @@ func testImage(t *testing.T, when spec.G, it spec.S) {
 						daemonInfo, err := dockerClient.Info(context.TODO())
 						h.AssertNil(t, err)
 
-						//image os must match daemon
+						// image os must match daemon
 						h.AssertEq(t, inspect.Os, daemonInfo.OSType)
 						h.AssertEq(t, inspect.Architecture, "arm64")
 						h.AssertEq(t, inspect.OsVersion, "10.0.99999.9999")
 
-						//base layer is added for windows
+						// base layer is added for windows
 						if daemonOS == "windows" {
 							h.AssertEq(t, len(inspect.RootFS.Layers), 1)
 						} else {

remote/remote.go

@@ -27,55 +27,55 @@ import (
 const maxRetries = 2
 
 type Image struct {
-	keychain   authn.Keychain
-	repoName   string
-	image      v1.Image
-	prevLayers []v1.Layer
-	createdAt  time.Time
+	keychain            authn.Keychain
+	repoName            string
+	image               v1.Image
+	prevLayers          []v1.Layer
+	createdAt           time.Time
 	addEmptyLayerOnSave bool
 }
 
 type options struct {
-	platform          imgutil.Platform
-	baseImageRepoName string
-	prevImageRepoName string
-	createdAt         time.Time
+	platform            imgutil.Platform
+	baseImageRepoName   string
+	prevImageRepoName   string
+	createdAt           time.Time
 	addEmptyLayerOnSave bool
 }
 
 type ImageOption func(*options) error
 
-//WithPreviousImage loads an existing image as a source for reusable layers.
-//Use with ReuseLayer().
-//Ignored if image is not found.
+// WithPreviousImage loads an existing image as a source for reusable layers.
+// Use with ReuseLayer().
+// Ignored if image is not found.
 func WithPreviousImage(imageName string) ImageOption {
 	return func(opts *options) error {
 		opts.prevImageRepoName = imageName
 		return nil
 	}
 }
 
-//FromBaseImage loads an existing image as the config and layers for the new image.
-//Ignored if image is not found.
+// FromBaseImage loads an existing image as the config and layers for the new image.
+// Ignored if image is not found.
 func FromBaseImage(imageName string) ImageOption {
 	return func(opts *options) error {
 		opts.baseImageRepoName = imageName
 		return nil
 	}
 }
 
-//WithDefaultPlatform provides Architecture/OS/OSVersion defaults for the new image.
-//Defaults for a new image are ignored when FromBaseImage returns an image.
-//FromBaseImage and WithPreviousImage will use the platform to choose an image from a manifest list.
+// WithDefaultPlatform provides Architecture/OS/OSVersion defaults for the new image.
+// Defaults for a new image are ignored when FromBaseImage returns an image.
+// FromBaseImage and WithPreviousImage will use the platform to choose an image from a manifest list.
 func WithDefaultPlatform(platform imgutil.Platform) ImageOption {
 	return func(opts *options) error {
 		opts.platform = platform
 		return nil
 	}
 }
 
-//WithCreatedAt lets a caller set the created at timestamp for the image.
-//Defaults for a new image is imgutil.NormalizedDateTime
+// WithCreatedAt lets a caller set the created at timestamp for the image.
+// Defaults for a new image is imgutil.NormalizedDateTime
 func WithCreatedAt(createdAt time.Time) ImageOption {
 	return func(opts *options) error {
 		opts.createdAt = createdAt
@@ -93,7 +93,7 @@ func AddEmptyLayerOnSave() ImageOption {
 	}
 }
 
-//NewImage returns a new Image that can be modified and saved to a Docker daemon.
+// NewImage returns a new Image that can be modified and saved to a Docker daemon.
 func NewImage(repoName string, keychain authn.Keychain, ops ...ImageOption) (*Image, error) {
 	imageOpts := &options{}
 	for _, op := range ops {
@@ -113,9 +113,9 @@ func NewImage(repoName string, keychain authn.Keychain, ops ...ImageOption) (*Im
 	}
 
 	ri := &Image{
-		keychain: keychain,
-		repoName: repoName,
-		image:    image,
+		keychain:            keychain,
+		repoName:            repoName,
+		image:               image,
 		addEmptyLayerOnSave: imageOpts.addEmptyLayerOnSave,
 	}
 
@@ -192,7 +192,7 @@ func prepareNewWindowsImage(ri *Image) error {
 		return err
 	}
 
-	windowsBaseLayer, err := tarball.LayerFromReader(layerBytes)
+	windowsBaseLayer, err := tarball.LayerFromReader(layerBytes) // TODO: LayerFromReader is deprecated; LayerFromOpener or stream.NewLayer are suggested alternatives however the tests do not pass when they are used
 	if err != nil {
 		return err
 	}

remote/remote_test.go

@@ -139,7 +139,7 @@ func testImage(t *testing.T, when spec.G, it spec.S) {
 				h.AssertNil(t, err)
 				h.AssertEq(t, osVersion, "10.0.17763.316")
 
-				//base layer is added for windows
+				// base layer is added for windows
 				topLayerDiffID, err := img.TopLayer()
 				h.AssertNil(t, err)
 
@@ -460,7 +460,7 @@ func testImage(t *testing.T, when spec.G, it spec.S) {
 						h.AssertNil(t, err)
 						h.AssertEq(t, osVersion, "10.0.99999.9999")
 
-						//base layer is added for windows
+						// base layer is added for windows
 						topLayerDiffID, err := img.TopLayer()
 						h.AssertNil(t, err)
 
@@ -1426,7 +1426,7 @@ func testImage(t *testing.T, when spec.G, it spec.S) {
 
 				h.AssertNil(t, img.Save())
 
-				//convert authenticated repo name to unauthenticated repo name
+				// convert authenticated repo name to unauthenticated repo name
 				authRepoRef, err := name.ParseReference(repoName, name.WeakValidation)
 				h.AssertNil(t, err)
 				sharedImageName := authRepoRef.Context().RepositoryStr()